Get a saved capture and short-lived artifact download URLs

Requires an API key owned by the capture's account. The service deliberately returns the same 404 response when the capture is absent, a finite-retention capture has expired, or it belongs to another account. New saves have a finite plan-bounded expiry; a historic saved row with expiresAt null is legacy permanent retention. The response has no separate S3 object-key field, but a signed downloadUrl can contain storage-path information and is a secret capability: do not log it or expose it to an untrusted client. Each URL expires no later than one hour after issuance and, for a finite-retention capture, is clamped not to outlive it.